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Claim 10 - amend as follows: 

10. (Amended) The device as claimed in claim 9, wherein a generator using a 
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checks. 
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Signing and signature checking of messages 



Technical field 



5 The invention relates to the signing and signature 
checking of messages using secret keys . 

Prior art 

10 In order to provide protection against corruption of 
messages, it is known for symmetrical cryptography to 
be used to form a signature by means of which the 
receiver can check, with very high probability, whether 
the message has been transmitted without corruption and 

15 originates from the predetermined sender. However, one 
precondition is that the sender and receiver have a 
common, secret key, which must be stored in secure 
form. One such method is described, for example, in 
Patent Specification US 4,549,075. 

20 

Symmetrical cryptography, in particular the DES method, 
is frequently used in smart cards, because this method 
can be programmed very efficiently. The smart cards 
furthermore have a read only memory in which a main key 
25 is stored in secure and secret form, and this main key 
is also stored in secure form in a control center. 

If it is now intended to send a message, protected 
against corruption, from a sender to the receiver, in 
3 0 this case the smart card, then, until now, the sender 
has had to have the message signed by the control 
center, since the . control center cannot provide the 
sender with the secret main key 
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without weakening the entire system. Furthermore, 
measures are required to ensure that the message is 
protected against corruption and imitation of a 
legitimate sender during transmission from the sender 
5 to the main center. 

The object of the invention is thus to specify a method 
for corruption protection of messages by means of a 
signature which can be formed by a sender and can be 
10 sent to a receiver without the sender having the secret 
main key, which is shared by the receiver and a control 
center, or without the message having to be sent in 
advance to the control center, for signature formation. 

15 Description of the invention 

The invention uses a method in which the control center 
forms signing keys in advance, and provides them to the 
sender. As is described in more detail in the exemplary 
20 embodiments, the receiver can model the signing key, 
and can thus check the message. 

This relates to a method for signing a message, in 
which a control center and the receiver have a 

25 permanent, common main key. The control center produces 
a sequence number in advance, and produces a signing 
key from this by means of a one-time function. Both are 
provided to the sender, in secure form. The sender uses 
the signing key to form a signature for the message, 

30 and sends this signature with the sequence number and 
the message to the receiver. The receiver uses a one- 
time function, main key and sequence number to form a 
check key, and thus checks the signature on the 
message . 
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Further features and advantages of the invention result 
from the following description, which explains the 
invention with reference to an exemplary embodiment and 
in conjunction with the attached drawing. 

5 

Brief description of the drawing 
In the figures : 

10 Figure 1 shows a diagram in which the data flow is 
symbolized, with the components involved. 

Description of at least one embodiment at least of the 
invention 

15 

Figure 1 indicates the three parties involved in the 
method, namely the control center 10, the sender 20 and 
the receiver 30, separated by dashed-dotted lines. 

20 The control center 10 contains a secure memory 11 for a 
secret key which is otherwise used, for example, in a 
symmetrical cryptographic encryption or signing method. 
The receiver 30 contains a corresponding memory 11', 
which contains the same key. This key is written to the 

25 control center during initialization, for example, if 
the receiver 30 is a smart card. Otherwise, key 
distribution methods known from cryptography can be 
used. In this case, the key is stored only once or at 
very long time intervals; the storage can be regarded 

3 0 as being permanent for the method according to the 
invention . 
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The control center 10 furthermore contains a sequence 
generator 12. This provides a series of numbers, which 
each differ. In the simplest case, this is a sequential 
number. However, it is better to use a known pseudo- 
5 random number generator, for example using the modulo 
method. If the parameters are chosen correctly, these 
pseudo- random number generators produce a sequence of 
new numbers in each case until the cycle which is 
governed by the modulus has been run through. 
10 Decreasing numbers or numbers with a step interval 
greater than unity can also be used. It is likewise 
possible to use the date and time as a unique sequence 
number, possibly as the number of seconds since an 
appointed start. 

15 

The control center thus produces one or more sequence 
numbers 12. A one-time encrypter 13 uses the main key 
to form a signing key 14 from such a sequence number 
12. This is most easily done by the sequence number 12 

2 0 being encrypted by means of the main key. In this case, 
a short sequence number is filled out by means of 
further data to the block length of the encryption 
method. Although binary zeros can be used for this 
purpose, it is better to use a function of the sequence 

2 5 number, for example its square. It is also possible to 
use a constant text, which does not consist of binary 
zeros and is kept confidential. Since the block size is 
generally in the same order of magnitude as the key 
length, it is still possible to use the result as a 

30 key; if necessary, bits must be added or the number of 
bits reduced by convolution. 

The essential characteristic of the one-time encrypter 
is that it is virtually impossible to deduce the main 



99P6221 



- 5 - 



key. Although the method just described is not a one- 
time encryption since, for example, the receiver could 
form the sequence number from the signing key by 
decryption, the "one-time" functionality is the main 
5 feature. 

Other one-time functions are thus used in other 
embodiments which link the main key and the sequence 
number in a reproducible manner to form a signing key 

10 without anyone who does not have the main key relating 
to a given sequence number being able to form a valid 
signing key, or vice versa, or being able to determine 
the main key from the signing key and the sequence 
number. Such methods are generally referred to as 

15 "message authentication codes" (MAC) . One such method 
may be formed, in particular, by applying any desired 
cryptograph! cally secure one-time function to a 
combination of a main key and sequence number. A 
concatenation, exclusive-OR, multiplication with or 

20 without modulo formation or addition, etc., may be used 
as the combination. 

The control center 10 thus provides one or more pairs 
of sequence numbers 12, and signing keys 14 produced 
2 5 from them. This can be done, for example, by printing 
out on security paper, by storage in a further smart 
card or by some other secure data transmission. These 
pairs are provided to the sender 2 0 in advance, who 
must store them in a secure and confidential manner. 

30 

The sender 20 who wishes to send a message 21 to the 
receiver 30 takes a pair of sequence numbers 12 and 
signing keys 14 and uses the signer 24 to determine the 
signature for the message 21. The DES method, for 
35 example 
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in accordance with ANSI X9 . 9 , is preferably also used 
in this case. Alternatively, a signature can be 
produced by a combination of a cryptographic hash 
function and a message authentication code. Methods 
5 relating to this have been described frequently and 
comprehensively in the cryptographic literature. 

The sender then forms a data set 22, which contains 
three fields with the sequence number 22a, the message 
10 22b and the signature 22c. The signing key 14 which has 
just been used is deleted. 

The data set 22 is now transmitted to the receiver 30, 
which thus receives a data set 22* which once again 
15 contains three fields, which are regarded as the 
sequence number 22a', the message 22b' and the 
signature 22c". Normally, this data set has already 
been protected against transmission errors by other 
security or plausibility mechanisms. 

20 

The receiver extracts the sequence number 22a' from the 
received data set 22', and passes this together with 
the main key 11' to one-time encryption 13' which, in 
the same way as the one-time encryption 13, is located 

25 in the control center 10 and is functionally identical 
to it. A check key 14' is produced at the output of the 
one-time function. If the sequence number has been 
transmitted correctly, this check key 14' is identical 
to the signing key 14 which the sender 2 0 has used. The 

30 check key 14' is passed to a signature checker 38 
together with the message 22b' which has arrived and 
the signature 22c' which has arrived. If all three 
match one another, an enable signal for further use of 
the message is produced at the output of the signature 

35 checker 38. At the end of the check, the check key 14' 
is destroyed, irrespective of the result. 
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In one development of the invention, the receiver 
maintains a list of already used sequence numbers, and 
rejects messages with already used sequence numbers. 
This provides additional security against misuse. 

5 

Since the sequence number is preferably produced by a 
deterministic generator, there is no need to transmit 
the sequence number. Since the common main key has to 
be transmitted in a secure environment to the receiver 

10 in any case, the initial value of the generator can be 
transmitted at the same time. Whenever a message is 
received, the receiver produces a new value for the 
sequence number, and thus forms the check key 14' 
without the sequence number having to be transmitted as 

15 well. In order to be robust against double 
transmissions and lost messages, one of the last and 
following sequence numbers is expediently also then 
used. In this case as well, the control center can 
provide the sender with a number of signing keys 14, 

20 which the sender should then use in the predetermined 
sequence . 

One possible application of the invention is in the 
field of automatic cash dispensers. The control center 

25 is in this case the bank control center, which uses a 
main key for checking the PIN and supplies personalized 
checking modules to the manufacturer of automatic cash 
dispensers in the control center. The sender may be a 
manufacturer or a local bank organization which, for 

3 0 example, wishes to load a currency conversion rate or a 
discount rate into the automatic cash dispensers; 
however, such organizations cannot introduce their own 
secret key into the cash dispenser, nor do they wish to 
install their own security module. 
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If the receiver does not contain a non-volatile memory, 
the receiver can also produce the sequence numbers from 
the start and test the signature with each of them. The 
loss of security in this case is low, but this does not 
provide any protection against double use. 
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Patent: Claims 



1. A method for signing a message (22) by a sender 
(20), and for checking the signature by a 

5 receiver, wherein a control center (10) and a 

receiver (3 0) have a secret, common main key (11, 
11'), having the following features: 
the control center (10) 

* produces a sequence number ( 12 ) and 

10 * from this and using the main key (11) 

produces a signing key (14) by means of one- 
time encryption (13), and 

* provides the sender with the signing key 
(14) ; 

15 - the sender (20) 

* uses the signing key (14) to form a signature 
(22c) for the message (21, 22c) and 

* sends to the receiver a message set (22) 
which contains at least the message (22b) and 

2 0 the signature (22c) . 

The receiver (30) 

* determines the sequence number (22a'), 

* forms the one check key (14') using the one- 
time encryption (13") and the main key (11'), 

2 5 and 

* uses this to check the signature (22c) on the 
message. 

2. The method as claimed in claim 1, wherein the 
sequence number (12, 22a, 22a') is transmitted 

3 0 together with the signing key (14) from 
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the control center to the sender (20) , and is 
transmitted from the sender (20) via the data set 
(22, 22") to the receiver. 

3. The method as claimed in claim 1, wherein the 
5 sequence number (12) is produced by a generator in 

synchronism with the number of signing and check 
keys used in the control center (10) and in the 
receiver . 

4. The method as claimed in claim 1, wherein the 
10 sequence number (12) is produced by a generator in 

synchronism with the number of signing and check 
keys used in the control center (10) and in the 
sender, and is transmitted via the data set (22, 
22') to the receiver. 
15 5 . The method as claimed in one of the preceding 
claims, wherein the sequence number is produced by 
a pseudo-random number generator. 

6 . The method as claimed in one of the preceding 
claims, wherein the encryption of the sequence 

20 number by means of the main key is used as the 

one-time encryption. 

7 . The method as claimed in one of the preceding 
claims, wherein the control center (10) produces a 
number of signing keys (14) in advance, and 

25 transmits them to the sender (30) , possibly 

together with the associated sequence numbers 
(12) . 

8 . The method as claimed in one of the preceding 
claims, wherein the receiver (3 0) maintains a list 

3 0 of already used sequence numbers, and rejects 

already used sequence numbers. 
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A device for signing a message (22, 22') which is 
sent from a sender (20) to a receiver (30), having 
the following features: 

a control center (10) and the receiver (30) 
have a first and a second memory for a secret, 
common main key (11, 11'); 

in the control center (10) , one input of a 
first one-time encrypter (13) is connected to 
the first protected memory (11), and another 
input is connected to a generator (12) for a 
sequence number, 

the output of the one-time encrypter (13) is 
connected to the sender (20) via a transport 
medium, 

- a signature generator (24) is provided in the 
sender, and its inputs are connected to the 
output of the one-time encrypter and to the 
message (21, 22b) to be signed, 

the output of the signature generator (24) is 
connected to a device which assembles at least 
the signature (22c) and the message (22b) to 
form a message block (22) and whose output is 
connected to the receiver (30) via a transport 
medium, 

a signature checker (22') is provided in the 
receiver, whose inputs are connected firstly to 
the message (22b') and to the signature (22c) 
of the message block (22') which has arrived 
via the transport medium, 

and secondly to the output of a second one-time 
encrypter (13'), whose inputs are connected 
firstly to the second memory (11') for the 



99P6221 



- 12 - 



secret main key and to a means for providing a 
sequence number (22a' ) . 
10. The device as claimed in claim 9, wherein a 
generator produces the sequence number (22a') 
5 using a deterministic method, [lacuna] one or more 

sequence numbers corresponding to the number of 
checks . 
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Abstract 



Method for signing a message, in which a control center 
and the receiver have a permanent, common main key. The 
control center produces a sequence number in advance, 
and a signing key from this by means of a one-time 
function. Both are provided in secure form to the 
sender. The sender uses the signing key to form a 
signature for the message, and sends the signature, 
with the sequence number and the message, to the 
receiver. The receiver uses a one-way function, main 
key and sequence number to form a check key, and thus 
checks the signature on the message. 



Figure 1 



"Version with markings to show changes made" 
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the control center to the sender (20) , and is 
transmitted from the sender (20) via the data set 
(22, 22') to the receiver. 

3. The method as claimed in claim 1, wherein the 
sequence number (12) is produced by a generator in 
synchronism with the number of signing and check 
keys used in the control center (10) and in the 
receiver. 

4. The method as claimed in claim 1, wherein the 
sequence number (12) is produced by a generator in 
synchronism with the number of signing and check 
keys used in the control center (10) and in the 
sender, and is transmitted via the data set (22, 

(fl^' ) to the receiver - /—QAmf 

5. ^ The method as claimed in{Io»e — ©f — the — prec e ding 

©Xa4*f»sJ, wherein the sequence number is produced by 
/„ a pseudo-random number generator. , 
6 . f The method as claimed in/ Cose— e-i — the — p rec e ding 
c - laimg [, wherein the encryption of the sequence 
number by means of the main key is used as the 
one-time encryption. afttM 1 

method as claimed in f ^ne — &€ — fehe — preceding 
eX^±m^, wherein the control center (10) produces a 
number of signing keys (14) in advance, and 
transmits them to the sender (30) , possibly 
together with the associated sequence numbers 

The method as claimed inf |£n@ — e-§ — the — pr e cedin g- 
©iaiffi^, wherein the receiver (30) maintains a list 
of already used sequence numbers, and rejects 
already used sequence numbers. 



/ one 
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secret main key and to a means for providing a 
4^) sequence number (22a- ). 
10. f The device as claimed in claim 9, wherein a 
g^nerator^ produces fefeez^rseguencg ^m^^^^^^ 
^^^^l^I^^^^^-Hre*^ one or more 
sequence numbers corresponding to the number of 
checks . 
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gebenen Auslandsanmeldungen fur ein Patent oder 
eine Erfindersurkunde, und habe auch alle Auslands- 
anmeldungen fiir ein Patent oder eine Erfindersurkun- 
de nachstehend gekennzeichnet, die ein Anmelde- 
datum haben, das vor dem Anmeldedatum der 
Anmeldung liegt, fur die Prioritat beansprucht wird. 



As a below named inventor, I hereby declare that: 



My residence, post office address and citizenship are 
as stated below next to my name, 



I believe 1 am the original, first and sole inventor (if 
only one name is listed below) or an original, first and 
joint inventor (if plural names are listed below) of the 
subject matter which is claimed and for which a patent 
is sought on the invention entitled 



the specification of which 

(check one) 

□ is attached hereto. 

□ was filed on as 

PCT international application 

PCT Application No. 

and was amended on 

(if applicable) 



I hereby state that I have reviewed and understand the 
contents of the above identified specification, including 
the claims as amended by any amendment referred to 
above. 



I acknowledge the duty to disclose information which 
is material to the examination of this application in 
accordance with Title 37, Code of Federal 
Regulations, §1 .56(a). 



I hereby claim foreign priority benefits under Title 35, 
United States Code, §119 of any foreign application^) 
for patent or inventor's certificate listed below and 
have also identified below any foreign application for 
patent or inventor's certificate having a filing date 
before that of the application on which priority is 
claimed: 
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Prior foreign appplications 
Prioritat beansprucht 






Priority Claimed 


19919909.4 Germany 


3 0 Aroxil 


1999 


Kl □ 


(Number) (Country) 
(Nummer) (Land) 


(Day Month Year Filed) 
(Tag Monat Jahr eingereicht) 


Yes No 
Ja Nein 








□ □ 


(Number) (Country) 
(Nummer) (Land) 


(Day Month Year Filed) 
(Tag Monat Jahr eingereicht) 


Yes No 
Ja Nein 








□ □ 


(Number) (Country) 
(Nummer) (Land) 


(Day Month Year Filed) 
(Tag Monat Jahr eingereicht) 


Yes No 
Ja Nein 


Ich beanspruche hiermit gemass Absatz 35 der Zivil- 
prozessordnung der Vereinigten Staaten, Paragraph 
120, den Vorzug aller unten aufgefuhrten Anmel- 
dungen und falls der Gegenstand aus jedem Anspruch 
dieser Anmeldung nicht in einer fruheren 
amerikanischen Patentanmeldung laut dem ersten 
Paragraphen des Absatzes 35 der ZivilprozeBordnung 
der Vereinigten Staaten, Paragraph 122 offenbart ist, 
erkenne ich gemass Absatz 37, Bundesgesetzbuch, 
Paragraph 1.56(a) meine Pflicht zur Offenbarung von 
Informationen an, die zwischen dem Anmeldedatum 
der fruheren Anmeldung und dem nationalen oder 
PCT internationalen Anmeldedatum dieser Anmeldung 
bekannt geworden sind. 


1 hereby claim the benefit under Title 35. United States 
Code. §120 of any United States application(s) listed 
below and, insofar as the subject matter of each of the 
claims of this application is not disclosed in the prior 
United States application in the manner provided by 
the first paragraph of Title 35, United States Code, 
§122, I acknowledge the duty to disclose material 
information as defined in Title 37, Code of Federal 
Regulations, §1 .56(a) which occured between the 
filing date of the prior application and the national or 
PCT international filing date of this application. 


(Application Serial No ) 
(Anmeldeseriennummer) 


(Filing Date) 
(Anmeldedatum) 


(Status) 

(patentiert, anhangig, 
aufgegeben) 


(Status) 

(patented, pending, 
abandoned) 


(Application Serial No.) 
(Anmeldeseriennummer) 


(Filing Date) 
(Anmeldedatum) 


(Status) 

(patentiert, anhangig, 
aufgegeben) 


(Status) 

(patented, pending, 
abandoned) 


Ich erklare hiermit, dass alle von mir in der vorliegen- 
den Erklarung gemachten Angaben nach meinem 
besten Wissen und Gewissen der vollen Wahrheit 
entsprechen, und dass ich diese eidesstattliche Erkla- 
rung in Kenntnis dessen abgebe, dass wissentlich und 
vorsatzlich falsche Angaben gemass Paragraph 1001, 
Absatz 18 der Zivilprozessordnung der Vereinigten 
Staaten von Amerika mit Geldstrafe belegt und/oder 
Gefangnis bestraft werden koennen, und dass derartig 
wissentlich und vorsatzlich falsche Angaben die Gul- 
tigkeit der vorliegenden Patentanmeldung oder eines 
darauf erteilten Patentes gefahrden konnen. 


I hereby declare that all statements made herein of my 
own knowledge are true and that all statements made 
on information and belief are believed to be true, and 
further that these statements were made with the 
knowledge that willful false statements and the like so 
made are punishable by fine or imprisonment, or both, 
under Section 1001 of Title 18 of the United States 
Code and that such willful false statements may 
jeopardize the validity of the application or any patent 
issued thereon. 
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VERTRETUNGSVOLLMACHT: Als benannter Erfinder 
beauftrage ich hiermit den nachstehend benannten 
Patentanwait (oder die nachstehend benannten 
Patentanwalte) und/oder Patent-Agenten mit der 
Verfotgung der vorliegenden Patentanmeldung sowie 
mit der Abwicklung aller damit verbundenen Geschafte 
vor dem Patent- und Warenzeichenamt: (Name und 
Registrationsnummer anfuhren) 



POWER OF ATTORNEY: As a named inventor, I 
hereby appoint the following attorney(s) and/or 
agent(s) to prosecute this application and transact all 
business in the Patent and Trademark Office 
connected therewith, (list name and registration 
number) 



Attorneys of the firm of McCormick, Paulding & Huber LLP as shown on the attached list 



Telefongesprache bitte richten an: 
(Name und Telefonnummer) 



Direct Telephone Calls to: (name and telephone 
number) 

Donald K. Huber (860) 549-5290 



Postanschrift: 



Send Correspondence to: 

Donald K. Huber 



Volier Name des einzigen Oder ursprunglichen Erfinders 

MOLTE ,., M ichael 



Full name of sole or first inventor: 



Unterschrit^les Erfinders 



Datum 



Inventor's signature 



Wohnsitz 

D-33034 Brakel, Deutschland 



Staatsangehorigkeit 

deutsch 



Postanschrift 

Koberg Weg 2a 



Post Office Addess 



D-33034 Brakel 
Deutschland 

Voller Name des zweiten Miterfinders (falls zutreffend): 



Unterschrift des Erfinders 



Staatsangehorigkeit 



Full name of second joint inventor, if any: 



Second Inventor's signature 



Post Office Address 



{Bitte entsprechende Informationen und Unterschriften im (Supply similar information and signature for third and 
Falle von dritten und weiteren Miterfindern angeben). subsequent joint inventors). 
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Voller Name des dritten Miterfinders: 


Full name of third joint inventor: 


Unterschrift des Etfinders 


Datum 


Inventor's signature 


Date 


Wohnsitz 


Residence 


Staatsangehorigkeit 


Citizenship 


Postanschrrft 


Post Office Address 






Voller Name des vierten Miterfinders (falls zutreffend)' 


Full name of fourth joint inventor, if any: 


Unterschrift des Erfmders 


Datum 


Inventor's signature 


Date 




Residence 


Staatsangehorigkeit 


Citizenship 


Postanschrift 


Post Office Address 






Voller Name des funften Miterfinders (falls zutreffend) 1 


Full name of fifth joint inventor, if any 


Unterschrift des Erfinders 


Datum 


Inventor's signature 


Date 


Wohnsitz 


Residence 


Staatsangehorigkeit 


Citizenship 


Postanschrift 


Post Office Address 






Voller Name des sechsten Miterfinders (falls zutreffend): 


Full name of sixth joint inventor, if any: 


Unterschrift des Erfinders 


Datum 


Inventor's signature 




Wohnsitz 


Residence 


Staatsangehorigkeit 


Citizenship 


Postanschrift 


Post Office Address 







(Bitte entsprechende Informationen und Unterschriften im (Supply similar information and signature for third and 



Falle von dritten und weiteren Miterfindem angeben). subsequent joint inventors). 
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Attachment to: German Langauage Declaration 



McCgma^^^gMBatec LLP Telephone: (860) 549-5290 

^hxPiaceJL_ Telefax: (860) 527-0464 

185AsYhMi_Str^ 
Tkrtford^C^ecti^^ 

u.s.Z 




Attorneys 
Donald K. Huber 
Theodore R. Paulding 
John C. Hilton 
) t> J Arthur F. Dionne 

Frederick J. Haesche ^f^9 

John C. Linderman . 24,420 

J. Kevin Grogan ^31^961 

Richard R. Michaud ^P_l 088 

Daniel G. Mackas 3^541 

Peter J. Rainville 41,263 

Marina F. Cunnigham _38j4 1 9 

Susan C. Oygard _ 42 !?69 

Nicholas J. Tuccillo 44,322 

Stephen P. Scuderi 42J 3 6 

Wm. Tucker Griffith 44,726 



